# Images posted via HTTP URL are not being displayed until downloaded to local
**URL:** https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193
**Category:** Bug
**Created:** [10.Январь.2019 14:20:28 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193 "2019-01-10T14:20:28Z")
**Posts on this page:** 18
**Page:** 1
### Author:  [@Richie](https://meta.discourse.org/u/Richie)
#### Post date: [10.Январь.2019 14:20:28 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/1 "2019-01-10T14:20:28Z")
Hi everyone,
Running Discourse [v2.2.0.beta7 +110](https://github.com/discourse/discourse/compare/1fdbf0fc9b7e2cc81f58a40fd85944334dd5117c...tests-passed)
When people post a new topic and they embed an image by pasting the image URL on a blank line, the image does not appear until some minutes later, when Sidekiq has downloaded the remote image to local (albeit AWS S3).
This only occurs when people paste HTTP URLs to remote images in to their post, all HTTPS images are displaying fine.
Here’s what everyone sees in the minutes before the image is pulled locally:
Firefox 64.0.2 on Windows 7:
Chrome 70.0.3538.102 on Windows 7:
Some steps to replicate…
1. Start a new topic
2. Paste a URL to an externally hosted HTTP image (_not_ https)
3. The image preview appears fine on the right hand side but there is a yellow warning in browser console:
4. Upon posting the topic, the image also displays fine at first (only to the author of the post) but now there are lots of red and yellow warnings now:
5. Navigate away from that new post then go back in to it (and/or refresh the page to clear the console too). Image is no longer displayed and there are console warnings and errors in red / yellow about mixed content.
6. Wait five minutes for the image to be pulled locally and for System user to edit the first post with the new / local image URL and it then displays fine with no warnings.
Again, this only occurs on HTTP image URLs, all https image urls are fine.
`ember_jquery.js` seems to throw the yellow warnings of “Loading mixed (insecure) display content “`http://www.sebulli.com/Testbildgenerator/testbild.gif`” on a secure page”
---
### Author:  [@Richie](https://meta.discourse.org/u/Richie)
#### Post date: [10.Январь.2019 14:25:09 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/2 "2019-01-10T14:25:09Z")
Potentially not a bug though, could just be “by design” of the browser(s)…?
---
### Author:  [@marcozambi](https://meta.discourse.org/u/marcozambi)
#### Post date: [10.Январь.2019 15:31:46 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/3 "2019-01-10T15:31:46Z")
If your Discourse forum is served over https, then having links to images which are not from an https website will create an error for mixed content. Most browsers will rightfully complain and, depending on their configuration, refuse to load the image.
---
### Author:  [@Richie](https://meta.discourse.org/u/Richie)
#### Post date: [10.Январь.2019 15:51:34 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/4 "2019-01-10T15:51:34Z")
Yeah I can understand that.
Strange how it displays in the preview at first though? And when the Topic is first posted.
It’s causing some issues with people thinking their image embed failed, so they do it again 😕
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [10.Январь.2019 23:30:29 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/5 "2019-01-10T23:30:29Z")
@techapj worked on this recently and can comment. It depends on the target domain of the URL.
---
### Author:  [@Richie](https://meta.discourse.org/u/Richie)
#### Post date: [15.Январь.2019 09:28:05 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/7 "2019-01-15T09:28:05Z")
Any thoughts on this one @techAPJ?
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [16.Январь.2019 03:43:21 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/8 "2019-01-16T03:43:21Z")
I discussed this issue with @sam last week and there’s not much we can do here since sharing non-secure assets on a secured forum is essentially a self-inflicted end user issue.
What we can do here is stop showing image previews for non-secure assets on a secure forum so the end user does not get confused if the image does not show up when the post is created.
---
### Author:  [@fuzzyk](https://meta.discourse.org/u/fuzzyk)
#### Post date: [16.Январь.2019 16:02:48 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/9 "2019-01-16T16:02:48Z")
This is new behavior. It is caused by the newly implemented lazy-loading of images. It did _not_ occur before.
The lazy-loading mechanism somehow causes browsers to treat the images as _active_ content. _Passive_ content (like plain old `![]()
` tags) is allowed to load from non-secure sources. This will result in a _warning_, not an error:
First line: Discourse doing its thing. Second line: Me in DevTools manually creating an `![]()
` tag.
Please reconsider or at least make lazy-loading images optional.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [17.Январь.2019 03:27:08 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/10 "2019-01-17T03:27:08Z")
That won’t be happening, sorry.
---
### Author:  [@Richie](https://meta.discourse.org/u/Richie)
#### Post date: [17.Январь.2019 09:50:25 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/11 "2019-01-17T09:50:25Z")
> [@techAPJ](#):
>
> there’s not much we can do here since sharing non-secure assets on a secured forum is essentially a self-inflicted end user issue
Yeah, I [suspected](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/2) this might be the case 😕
> [@techAPJ](#):
>
> What we can do here is stop showing image previews for non-secure assets on a secure forum so the end user does not get confused if the image does not show up when the post is created
I agree that _something_ needs to change.
As per my steps to replicate, the user goes away thinking their shiny image-embedded post has worked yet anyone viewing their post before the image has been pulled down locally simply sees a broken/missing image.
Which is a poor user experience all round 😢
So we have a few options available I’m guessing?
Option one, as you suggested @techAPJ is to simply not show the preview - the user can then see the image is not going to work (although it _does_ work when fetched to local 5 mins later).
Option two, as @fuzzyk suggested, use an `![]()
` tag - which @codinghorror ruled out.
Option three, can you you use the `![]()
` tag which Jeff isn’t keen on, then at the point of fetching the image locally, edit the post to use whatever code you currently use and replace the `![]()
` at the same time as replacing the image URL?
Option four, can I change the amount of time it takes to download the image locally? It seems to be approx 5 minutes. Can I lower this to 10 seconds or something?
Any other thoughts / options available? 👍🏻
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [17.Январь.2019 11:51:57 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/12 "2019-01-17T11:51:57Z")
My favorite option is just to have the preview not turn the insecure image link into an image tag, leave it as a link
There is no first class support for hotlinking images outside of onebox
---
### Author:  [@Richie](https://meta.discourse.org/u/Richie)
#### Post date: [17.Январь.2019 13:58:41 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/13 "2019-01-17T13:58:41Z")
> [@sam](#):
>
> My favorite option is just to have the preview not turn the insecure image link into an image tag, leave it as a link
Would the remote image still get downloaded to local five minutes later and `system-user` edit the post to embed and display it properly @sam ?
---
### Author:  [@Richie](https://meta.discourse.org/u/Richie)
#### Post date: [21.Январь.2019 21:21:37 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/14 "2019-01-21T21:21:37Z")
Any more thoughts on this, anyone?
I can’t be the only one suffering this issue, surely? 😊
---
### Author:  [@fuzzyk](https://meta.discourse.org/u/fuzzyk)
#### Post date: [23.Январь.2019 15:28:19 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/15 "2019-01-23T15:28:19Z")
Sorry for not being able to respond in the last few days.
My only issue with this is how the new lazy loading system somehow breaks existing functionality, even if that may have been “accidental” functionality. I strongly believe it doesn’t have to be this way!
I’ll look into what exactly causes browsers to treat the images as active content, which is basically the _only_ issue here.
(`![]()
` tags are already used, by the way, so there must be some counter-intuitive API restriction somewhere.)
/edit: Okay, trivial testing reveals this is related to the use of `srcset`s.
/edit2: Here’s a [blog post on this topic](https://snook.ca/archives/html_and_css/mixed-content-responsive-images). It appears there is no trivial solution.
/edit3: I have found the issue and will present a pull request shortly.
/edit4: Here’s the pull request:
[https://github.com/discourse/discourse/pull/6935](https://github.com/discourse/discourse/pull/6935)
---
### Author:  [@Richie](https://meta.discourse.org/u/Richie)
#### Post date: [23.Январь.2019 20:58:14 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/16 "2019-01-23T20:58:14Z")
I’ve not updated with this fix yet, but thanks in advance @fuzzyk mate 👍🏻
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [24.Январь.2019 02:21:55 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/17 "2019-01-24T02:21:55Z")
Oh awesome, thanks for that fix! 🍻
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [24.Январь.2019 10:46:28 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/18 "2019-01-24T10:46:28Z")
PR is merged and I verified the fix on [try.discourse.org](http://try.discourse.org). Thanks @fuzzyk 👍
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [24.Январь.2019 10:46:33 UTC](https://meta.discourse.org/t/images-posted-via-http-url-are-not-being-displayed-until-downloaded-to-local/106193/19 "2019-01-24T10:46:33Z")